Log Monitoring with Zabbix

[fabiopig]

Good morning everyone,
first of all a greeting to all, I am a new user of the forum.
I am writing to ask you for a help in configuring Zabbix for monitoring Log files.
The version of Zabbix in use is: Zabbix 5.0.12 on Docker desktop.
I configured Zabbix to read the contents of a log file of a CentOS 7 server, creating a Log_Monitoring template and inside it, I created a Log item configured as follows:

Type: Zabbix Agent (Active)
Key: log[/var/log/applicazione.log,,,,skip,,,] ho provato anche log[/var/log/applicazione.log,,,,skip,,]
Type Information: Log
Update interval: 1s
History storage period: Storage period 90d

I followed the official guide for configuring the Template and it seems to me that I have done everything correctly, but the log is not received by zabbix. On this server I have also enabled other templates such as Template Module Linux filesystems by Zabbix agent, which work regularly.
On the client in /var/log/zabbiz/zabbix_agentd.log I have no particular errors and the last line says:
31680: 20220318: 102811.088 active check configuration update from [xxx.xxx.xxx.xxx:10051] is working again
hich makes me understand that the active mode agent works regularly. On the other hand, I cannot view the server log files, as I cannot find them in the Docker container.

I hope someone can help me solve this problem that has been gripping me for some time.
Thank you

[Rak]

Please try with this..
Key: log[/var/log/applicazione.log, "ho provato anche ",,,skip,,]

[Rak]

Key: log[/var/log/applicazione.log, "ho provato anche",,,skip,,]

[vitS]

On the other hand, I cannot view the server log files, as I cannot find them in the Docker container.
----------------------------------------
You can find logs by typing: docker logs <container name of zabbix server> ( In Powershell or Command Prompt )
or
Find where containers placed ( In *NIX /var/lib/docker/container/.. ) and there will be json-log
or
Map new volume to zabbix server container: - <local path>:<path to zabbix logs in container>

[fabiopig]

Please try with this..
Key: log[/var/log/applicazione.log, "ho provato anche ",,,skip,,]

Thanks for response,
i think i made a mistake in the first post, i tried both:
Key: log[/var/log/applicazione.log,,,,skip,,,]
Key: log[/var/log/applicazione.log,,,,skip,,]

I also tried what you suggested
Key: log[/var/log/applicazione.log, "ho provato anche",,,skip,,]

but nothing has change, the logs don't came to zabbix server

[jramirez]

Hi every One. Hope you are well.
Some one who be so kind to tell me where to find and download a valid/trusted Zabbix Module for PS.

Many thanks and regards.

[Rak]

Hello,

Can somebody help me on how can I capture previous and next two lines of a matched keyword in a log file. I am still a beginner so it would be nice if you can share detailed steps.

[TIME]=2022/03/29 08:01:47
[TYPE]=E
[MSG]
Machine : WS-A01, Module: CTS RequestProcessing, generation Time :Tue Mar 29 08:57:47 XYZ 2022, Message :Long Processing Time: 2036 ms-MessageType: ABC EFG LOOKS LIKE A SYSTEM ERROR-GId: 2341-RequestId: WS-A01~REPORT~1234b14d72e912:2437ce83
[ACTION]

My keyword will be [TYPE]=E so where ever [TYPE]=E will be found it should capture the line above this and 2 lines just below this keyword line.

Thanks in advance.

Rak

[cyber]

https://regex101.com/r/icldbD/2

At least it works in regex101...

[ap2022]

Unfortunately it works only in regex101, but it doesn't seem to work in zabbix.
I've tried a lots of ways to capture line by regex and several lines after it (using and not using s,m and x modificators, [[:space:]],^,\n,$ symbols in lots of variations) and haven't succeeded :-(
My conclusion: Zabbix preprocessing perfectly works with multiline text data by regex, but zabbix agent is not able to capture multiple lines from log files by regex.

[Hamardaban]

The agent handles the log lines as they are “created”. Line by line.
There's no idea "many lines" for the agent.